MALPEDIA_Win_Yanluowang_Auto

rule MALPEDIA_Win_Yanluowang_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "1abc8756-0837-5551-801f-93787a9adedb"
		date = "2026-05-04"
		modified = "2026-05-18"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.yanluowang"
		source_url = "https://github.com/malpedia/signator-rules//blob/c901f97b7df03e41917da74c2a84b04c227316c2/rules/win.yanluowang_auto.yar#L1-L130"
		license_url = "N/A"
		logic_hash = "13f73cba5e2dc47bc7519cbe3ead263b6ded7801b671034999080b2b4b027200"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260422"
		malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
		malpedia_version = "20260504"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"

	strings:
		$sequence_0 = { c70600000000 c7461000000000 c7461407000000 895dec 83f807 7614 c645f000 }
		$sequence_1 = { b9???????? 8d8584f4ffff 0f1f440000 8a10 3a11 0f85f1000000 }
		$sequence_2 = { 8bd6 33f9 894238 8bc6 8b484c 8b5044 89783c }
		$sequence_3 = { 33e9 89afa0000000 bd01000000 23ea f7dd 23eb 33d8 }
		$sequence_4 = { 03048d38034600 50 ff15???????? 5d c3 8bff }
		$sequence_5 = { 8b45fc 03c1 894db4 8b4de4 33c6 8b7db4 8945c4 }
		$sequence_6 = { 8b7d08 33db 8b450c 8945e4 897ddc 8b0f 895de0 }
		$sequence_7 = { 235dc0 33ca 334dc0 335df8 894de4 03de }
		$sequence_8 = { 8b4df8 33c6 8945dc 83e701 0fb6c1 f7df 237de8 }
		$sequence_9 = { 7402 8938 8d7904 33d2 85ff 7402 }

	condition:
		7 of them and filesize < 834560
}